Messages in this thread | | | Date | Wed, 18 Nov 2015 11:02:25 +1100 (AEDT) | From | James Morris <> | Subject | Re: [PATCH v3 5/7] selinux: Add support for unprivileged mounts from user namespaces |
| |
On Tue, 17 Nov 2015, Seth Forshee wrote:
> Security labels from unprivileged mounts in user namespaces must > be ignored. Force superblocks from user namespaces whose labeling > behavior is to use xattrs to use mountpoint labeling instead. > For the mountpoint label, default to converting the current task > context into a form suitable for file objects, but also allow the > policy writer to specify a different label through policy > transition rules. > > Pieced together from code snippets provided by Stephen Smalley. > > Signed-off-by: Seth Forshee <seth.forshee@canonical.com> > Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <james.l.morris@oracle.com>
-- James Morris <jmorris@namei.org>
| |